Risk assessment is not a document, it's an ongoing process

A risk assessment is not a document, but the continuous reasoning that connects what can go wrong in the operation to what the organisation decides to do about it. The document is only the record of a moment, a photograph of how the work looked on the day the assessment was carried out, and the problem begins when that day recedes and the photograph stays on the wall as if it still described reality.

In most organisations, the risk assessment is treated as a deliverable that is done once, signed off and filed, and only revisited at the next audit. Between one review and the next, however, the operation changes: a new piece of equipment arrives, a contractor who does not know the area comes on site, a change to the process is approved to meet a production target. Real risk follows those changes day after day, while the filed assessment stays where it was, and it is precisely in that gap that protection ceases to exist.

The problem is not carrying out the assessment, it's keeping it alive

Carrying out the first assessment is usually the easy part, because there is an established method, a legal requirement and a deadline to meet, so the work gets done. The difficulty comes afterwards, once the document exists and the operation keeps moving, because an assessment that is not reviewed stops describing the real work and starts portraying an operation that no longer exists.

When that happens, the document still serves one function, that of providing evidence in an audit, but it stops serving the only one that really matters, which is to guide decisions before someone gets hurt. An accident that no one foresaw is almost never truly unforeseeable, because it is usually just a risk that changed without the assessment keeping up.

How often should a risk assessment be reviewed?

A risk assessment should be reviewed whenever something changes in the operation, after any incident or near miss, and at periodic intervals defined by the organisation. There is no single interval that fits every case, because the main trigger is not the calendar, but change.

The HSE, the British health and safety authority, is clear on this point: assessing risk is only one part of controlling it, and controls need to be reviewed periodically and whenever something relevant changes. ISO 45001:2018, in clause 6.1, points the same way when it treats hazard identification as an ongoing, proactive process rather than a one-off event. Across the European Union, the Framework Directive 89/391/EEC requires employers to evaluate risks and to adjust that evaluation as working conditions change, which makes review a legal duty and not a matter of good practice alone.

The difference between a static assessment and a living one

The distinction is not in the quality of the initial document, but in what happens to it once it is signed off. A static assessment is a point in time; a living assessment is a process that keeps pace with the operation.

The key point is that a living assessment does not require redoing everything every week, only that there is a short path between what changes in the field and the review of the corresponding risk. Without that path, any assessment, however good, begins to age the moment it is filed.

The triggers that should prompt a review

A number of situations should, in themselves, prompt a review of the risk assessment, regardless of when the last one was carried out:

• A change in the process or working method, even when it seems too small to matter.
• New equipment, or existing equipment operating in a condition other than the one foreseen.
• The introduction of a chemical or a material that the original assessment did not consider.
• The arrival of a contractor or a team unfamiliar with the specific risks of the area.
• A near miss or incident, which is the cheapest way the operation has of warning that a risk has been underestimated.
• A regulatory change, such as the inclusion of psychosocial risk in occupational risk management.
• Changes to layout, shift pattern or production pace that alter who is exposed, to what and when.

None of these triggers appears on the calendar months in advance, and that is why tying the review to a fixed date alone always leaves a window open, an interval in which the assessment and the reality of the operation drift in opposite directions.

Psychosocial risk has made the living assessment unavoidable

Psychosocial risk has moved from the margins of occupational health to the centre of it. ISO 45003:2021, the first international standard dedicated to managing psychological health and safety at work, asks organisations to identify and manage the work factors that affect mental health, and in the United Kingdom the HSE Management Standards already set out the areas employers are expected to assess. The European Framework Directive, by covering all risks to workers, brings psychosocial risk within the scope of the legal assessment duty, which exposes the limit of a static assessment directly.

Psychosocial risk does not behave like a stable physical hazard, because it shifts with reorganisations, targets, workload, changes of management and demand peaks. An assessment carried out once a year does not capture a deterioration that can set in within a few weeks, so taking this risk seriously means, in practice, adopting an assessment that updates with the operation rather than an annual exercise that always arrives too late.

How to keep the risk assessment alive in practice

Keeping an assessment alive is less a matter of individual discipline and more a matter of connecting the assessment to the workflow of the people in the operation. As long as it lives in a spreadsheet that only the EHS coordinator opens, it will age between audits no matter how much goodwill there is, because the data on what changed sits with the people who operate, not with the people who file.

This is where EHSQ software makes the difference, because when an operator can report a change of condition or a near miss the moment it happens, straight from the field and even without a connection, that report no longer waits for the next cycle and starts to trigger the review of the corresponding risk.

Glartek's EHSQ software was built from the operator's point of execution, precisely so that the data is born where the risk exists rather than reconstructed from memory months later.

The mechanics of the assessment itself, the five steps, the probability and severity matrix and the hierarchy of controls, are set out in full on the complete page: [Risk assessment: what it is and how to do it].

What remains once the assessment is done

A risk assessment is worth less for the document it produces and more for what changes after it, because, if the paperwork is impeccable but today's operation is no longer the one it describes, what exists is a file that is up to date and not a risk under control. The useful question is no longer when the last assessment was carried out, but what has happened in the operation since then that no one has recorded yet.

‍